CVE-2026-94205 Gitea fork workflow approval bypass through maintainer-triggered events
Attackers can bypass approval checks to execute arbitrary code on base repository runners by triggering maintainer events on fork pull requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-94205?
CVE-2026-94205 is a critical missing authorization vulnerability in Gitea Gitea, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For `pull_request` activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval, while the workflow definition was still taken from the fork head. Where Actions is enabled and a matching runner is registered, fork-controlled workflow code could run on the base repository's runners without an explicit approval.
Which versions are affected by CVE-2026-94205?
1 open source package ship an affected version, including gitea. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gitea Bitnami | All versions | 28.0.0 |
Products include Gitea Gitea.
How do I fix CVE-2026-94205?
Upgrade gitea to 28.0.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-94205 being exploited?
There is no known exploitation of CVE-2026-94205 in the wild and no public exploit code.
Other vulnerabilities in Gitea Gitea
Sources
Also known as BIT-gitea-2026-94205, GHSA-xh39-mxw9-34pp, MINI-cv4x-r822-gr6w, MINI-hmf8-gw77-66xp.